Microsoft knows that reliable software is not cost effective. According to studies, 90% to 95% of all bugs are harmless. They're never discovered by users, and they don't affect performance. It's much cheaper to release buggy software and fix the 5% to 10% of bugs people find and complain about.

If you ask amateurs to act as front-line security personnel, you shouldn't be surprised when you get amateur security.

A colleague once told me that the world was full of bad security systems designed by people who read Applied Cryptography

There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files.

It's certainly easier to implement bad security and make it illegal for anyone to notice than it is to implement good security.

Amateurs hack systems, professionals hack people.

Security is a process, not a product.